A recently discovered WhatsApp scam could result in you being locked out of your account permanently.
For so many of us, WhatsApp has become an integral part of keeping in touch with friends, family, colleagues and more. Being unable to access it would have serious ramifications – and a newly discovered scam could do just that.
With access to just your phone number, a hacker can orchestrate an attack that could result in your account being deactivated. What's more, it doesn't matter if you have two-factor authentication (2FA) enabled or not.
- Find out how to enable WhatsApp dark mode
- You can also turn down the lights with Facebook dark mode
- Finish the set with Instagram dark mode
While slightly convoluted, the attack is surprisingly simple to carry out, and takes advantage of a feature which is actually supposed to keep users secure. As described in detail by Forbes, which was first to report it, the scam uses two separate attack vectors, starting off with an attacker who knows your phone number requesting to activate WhatsApp on a different phone using your details.
WhatsApp will then attempt to verify the log in attempt by asking you for confirmation, In the meantime, the attacker can enter invalid confirmation codes at their end, ultimately resulting in your account being locked for 12 hours.
The second part of the attack sees the perpetrator contacting WhatsApp claiming to be you, reporting that their phone has been lost or stolen and that the account should be deactivated. WhatsApp automatically obliges, effectively locking you out of your account with a process that can be repeated time and time again.
What you should do
Even though the attack can be carried out on accounts that have 2FA enabled, WhatsApp says that the issues is unlikely to affect many people.
A spokesperson told both Forbes and TechRadar: "Providing an email address with your two-step verification helps our customer service team assist people should they ever encounter this unlikely problem. The circumstances identified by this researcher would violate our terms of service and we encourage anyone who needs help to email our support team so we can investigate."
The company advised TechRadar that if you suspect your WhatsApp account is under attack, you can send reports to inside the app by going to Settings > Help > Contact us. You can also email email@example.com for assistance.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Sofia is a tech journalist who's been writing about software, hardware and the web for nearly 20 years – but still looks as youthful as ever! After years writing for magazines, her life moved online and remains fueled by technology, music and nature.
Having written for websites and magazines since 2000, producing a wide range of reviews, guides, tutorials, brochures, newsletters and more, she continues to write for diverse audiences, from computing newbies to advanced users and business clients. Always willing to try something new, she loves sharing new discoveries with others.
Sofia lives and breathes Windows, Android, iOS, macOS and just about anything with a power button, but her particular areas of interest include security, tweaking and privacy. Her other loves include walking, music, her two Malamutes and, of course, her wife and daughter.